Ransomware : Your Feared Information Technology Nightmare
Ransomware Remediation ProfessionalsCrypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses of all sizes unprepared for an attack. Multiple generations of crypto-ransomware such as CrySIS, Fusob, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and continue to inflict damage. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus frequent unnamed newcomers, not only encrypt online data but also infiltrate all available system restores and backups. Data synchronized to cloud environments can also be encrypted. In a poorly architected system, this can make automatic restore operations useless and effectively sets the network back to zero.

Restoring applications and data following a crypto-ransomware outage becomes a sprint against time as the targeted business tries its best to stop lateral movement, eradicate the crypto-ransomware, and restore business-critical operations. Because ransomware requires time to replicate across a network, penetrations are often launched during nights and weekends, when attacks tend to take more time to identify. This compounds the difficulty of promptly assembling and orchestrating an experienced mitigation team.

Progent offers a range of solutions for securing Denver businesses from ransomware attacks. Among these are team training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to detect and extinguish day-zero modern malware assaults. Progent also provides the assistance of expert ransomware recovery consultants with the skills and perseverance to restore a breached system as quickly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware attack, paying the ransom in cryptocurrency does not ensure that cyber criminals will return the needed keys to decrypt any of your information. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to piece back together the key parts of your Information Technology environment. Without the availability of complete system backups, this requires a broad range of IT skills, top notch team management, and the ability to work non-stop until the task is complete.

For two decades, Progent has made available expert Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of expertise provides Progent the capability to efficiently identify important systems and integrate the surviving components of your Information Technology system after a crypto-ransomware event and assemble them into an operational system.

Progent's ransomware group utilizes best of breed project management applications to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting rapidly and in concert with a client's management and IT team members to assign priority to tasks and to put the most important systems back online as fast as humanly possible.

Case Study: A Successful Ransomware Attack Response
A business escalated to Progent after their network was penetrated by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean government sponsored cybercriminals, possibly using strategies leaked from the United States NSA organization. Ryuk seeks specific organizations with limited ability to sustain disruption and is among the most profitable versions of crypto-ransomware. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company based in Chicago and has around 500 employees. The Ryuk intrusion had brought down all business operations and manufacturing processes. The majority of the client's data protection had been on-line at the time of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for the best, but in the end called Progent.

"I can't say enough about the care Progent provided us during the most critical time of (our) businesses existence. We most likely would have paid the hackers behind this attack if it wasn't for the confidence the Progent team afforded us. The fact that you were able to get our messaging and critical servers back online sooner than one week was amazing. Every single staff member I interacted with or messaged at Progent was hell bent on getting us restored and was working at all hours on our behalf."

Progent worked with the customer to quickly get our arms around and prioritize the critical systems that needed to be recovered in order to resume company functions:

  • Microsoft Active Directory
  • Electronic Mail
  • Accounting and Manufacturing Software
To start, Progent adhered to Anti-virus penetration mitigation industry best practices by isolating and removing active viruses. Progent then began the steps of rebuilding Active Directory, the key technology of enterprise networks built on Microsoft technology. Microsoft Exchange email will not work without AD, and the client's accounting and MRP applications leveraged SQL Server, which requires Active Directory for authentication to the databases.

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then initiated rebuilding and hard drive recovery on mission critical applications. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Off-Line Data Files) on team PCs and laptops to recover mail messages. A recent offline backup of the client's accounting software made it possible to return these vital services back servicing users. Although a large amount of work still had to be done to recover fully from the Ryuk virus, essential systems were restored quickly:

"For the most part, the assembly line operation was never shut down and we made all customer deliverables."

Over the next couple of weeks critical milestones in the restoration project were made through tight cooperation between Progent team members and the customer:

  • Internal web sites were returned to operation with no loss of data.
  • The MailStore Microsoft Exchange Server containing more than 4 million archived emails was restored to operations and accessible to users.
  • CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory functions were completely recovered.
  • A new Palo Alto 850 security appliance was brought online.
  • Most of the desktop computers were being used by staff.
"A huge amount of what went on during the initial response is mostly a fog for me, but my management will not forget the dedication each of the team put in to give us our business back. I've utilized Progent for the past 10 years, maybe more, and each time I needed help Progent has come through and delivered as promised. This situation was a stunning achievement."

Conclusion
A likely business disaster was averted with hard-working experts, a wide array of subject matter expertise, and tight teamwork. Although in post mortem the crypto-ransomware penetration detailed here could have been disabled with advanced cyber security systems and best practices, staff training, and well designed incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and will continue. If you do get hit by a ransomware incident, remember that Progent's team of professionals has proven experience in ransomware virus defense, remediation, and data recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Tony and Chris (along with others who were contributing), I'm grateful for making it so I could get rested after we got over the first week. All of you did an fabulous effort, and if anyone is around the Chicago area, a great meal is my treat!"

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Denver
For ransomware system restoration consulting in the Denver area, call Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.